I need to calculate the time difference between 2 different events as shown below(Event1 and Event2). It gives the time required for a particular host to login.
These Events are going to be repeated over time. So I need to calculate the time for each of the Event pairs( so that I can calculate the average login time at the end)
Event1: 2:45:57.000 PM
Several other events with differnt EventCode or host info
Event2: 2:45:59.000 PM
I am trying the following command but it does not seem to give the desired output.
I need to do it for similar host(time for host=host1, time for host=host2 etc). Can you suggest if the above command would be useful or can you suggest a different command.
The exact log looks something like this
If I understand your question correctly (seems to be some editing required), you're making a mistake in the transactions command. You're doing the transaction over the wrong field. The point of having a transaction over a field, is that the value of the field is the same for all events considered to be part of the transaction. Think of a JSESSIONID or a client IP in a web server log, and you'll get the idea.
In your case, I think this search would work the way you want;
The result should look something like
Since there seems to be no true sessionID to go by, we'll make a transaction over a combination of fields. First however, we must make a rename of some fields, since there are some inconsistencies in Redmond naming standards.
Hope this helps,
I think the question was not very clear.
The output that I get by running this command is
What this command gives is the difference between the first Event-4648 time and the last Event-4624 time. But in the log there are several such combination of events ( 4648 and 4624 pairs )
What I actually want is the time difference between each 4648 and 4624 combinations separately (which gives me the time required for a user to login to a VM).
The output needs to be something like this.
which tells that Server-A took 10 seconds to login at time 12:23:34
and 20 Seconds at time 08:15:24
Pasting the log below for clarity